
UNITED STATES ENVIRONMENTAL PROTECTION AGENCY 
OFFICE OF INSPECTOR GENERAL 

TWO POTOMAC YARD 
2733 SOUTH CRYSTAL DRIVE 
ARLINGTON, VA 22202 


DATE: February 7,2011 PREPARED BY: SA| 

COMPLAINT#: COMP-2011-53 CROSS REFERENCE #: 

TITLE: UNKNOWN SUBJECT: POTENTIAL UNAUTHORIZED DISCLOSURE OF CBI 

COMPLAINT SUMMARY REPORT 


Subject(s) 


Location 


Other Data 


UNKNOWN SUBJECT 


Two Potomac Yard 
2733 South Ciystal Drive 
Arlington, VA 22202 


COMPLAINT: 



On December 29, 2010, ___ 

Enviro nmental Protect ion 
Agency (EPA), 1300 Pennsylvania Ave NW, Washington DC, 20004, notified 

this office via email of a possible unauthorized disclosure of Confidential Business Information 
(CBI). 


BACKGROUND: N/A 


INVESTIGATIVE FINDINGS: 


On January 20, 2011, Special Agent (SA 



was 

concerned that the missing Blanket Purchase Agreement (BPA) files might contanttlih^t or 
indirect labor rates belonging to Syracuse Research Corporation Inc. (SRC). According to 

■ ]. if labor rates existed in the files, a contractor could use them to underbid SRC, the 
it contractor, for a BPA bid scheduled later in the month. The bid solicitation was 
scheduled to go out Friday, January 21, 2011, or Monday, January 24, 2011. The missing files 
consisted of preliminary notes and wor k up inf ormation. However, no proposal information or 
evaluation connnents were in the files. identified 

EPA, 
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Arlington VA as the individual who maintained the files at the Potomac Yard office, 
spoke with EPA security at Potomac Yard and security reviewed video footage taken bll tin 
evening of December 14, 2010 and the morning of December 15, 2010, to see whether there was 
anyone leaving with anyboxes or large bags that might contain the files. Nothing out of the 
ordinary was noted. ^^^B had not officiallynotified the contractorabout the possible release 
of C5I but was goingWmnft a letter soon. BB|H stated has spoken with the 

contractor off and on and has informed theinoFme issue. 


On January 2Y 2011, mtemvwed who recalled moving two stacks 

of files ffotn^H desk, located m room ^^^B to a file drawer sometimein the beginning of 
December. Between moving the files ancTDecember 14, 2010.^1^^ went into the drawer 
once to retrieve a file containing step-by-step instruction^om^ertain process. 
subsequently returned the file. On December 14. 20Kf^^^^^^Bleft work late in the evening 
and returned the next morning around 10:00 am. ^^^^^Hnoticedthefile drawer slightly ajar 
and looking m^B noted the drawerto be empty. According the files were 

working files^W^ised to keep ^^^B organized. Once the offici al files were completed then the 
working files'are no longer neeaedoNo official files aremissing^^^^^^B did not believe the 
files contained any C'BI but^B was not 100% certain, ^^^^^^Bnutherbelieved the files 
were not stolen, rather som£6he in the office may have mistakenlyrnoved or filed them. 

_has multiple contacts with SRC dining the mo nth. One of those contacts was a 

conference call on December 21, 2010 where B - X -f i ll informed|_ 

about the possible 

theft of C'BI. stated both^^^^B and^^H did not seem to be concerned. 

lid not believe the documents would help any competitor for the new BPA since the 
only way any competitor would know about the new BPA is if a contracting officer notified them 
that they were on the source list. At the time of the incident, the new BPA was being put 
together and Cincinnati had yet to send out any solicitation. 


RECOMMENDATION: 


Based on the investigative findings, the Complaint was deter min ed to be imsubstantiated. The 
Agency and OI were unable to verify the existence of CBI in the missing files and were unable to 
ascertain whether the files were actually stolen or simply filed. Therefore, this Complaint will be 
closed at this time. If additional information is provided that substantiates the Complaint, an 
Investigation will be opened at that time. 
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UNITED STATES ENVIRONMENTAL PROTECTION AGENCY 
OFFICE OF INSPECTOR GENERAL 

TWO POTOMAC YARD 
2733 SOUTH CRYSTAL DRIVE 
ARLINGTON, VA 22202 


DATE: March 30, 2012 PREPARED BY: SApj|||gjJJJ 

COMPLAINT#: COMP 2012-112 CROSS REFERENCE #: 

TITLE: UNKNOWN SUBJECT: BREACH OF CLASSIFIED INFORMATION 

COMPLAINT SUMMARY REPORT 


Sub ject(s) 


Location 


Other Data 


Unknown 


Washington, DC 


COMPLAINT: On March 9, 2012,1 _ 

| received Hotline Complaint number 2012-097 
advising of the existence of potentially classified EPA information on the internet. 


reported 

located an EPA document titled “Draft/Confidential” on 
formation contained in the report and the title 

bc6r 


BACKGROUND: _ 

that while engaged in online researc 
an EPA.gov hosted site. Based on til 
reported this information to the EPA Office of Inspector General through the OIG We 
site. 


Moment 


INVESTIGATIVE FINDINGS: On March 9, 2012,_ 

forensically obtained a copy of the EP A document titled “Draft/ConfidentiaL 
located on an EPA.gov hosted web site. j|jj|2aj[j|||andl 11 

e'.'i.-wed ilie 

document which was titled Managed Desktop Services and Support (MDSS) Statement of Work. 
The review determined that the document was a statement of work for help desk support services 
for EPA’s Office of Environmental Information (OEI), Office of Technology Operations and 
Planning (OTOP). 


Contac t was made with I 

!^i|H EPA. Washington. DC. Both individuals advised that a MDSS statement of work was 
recently releasedbyEPA contracting for solicitation and that the statement of work was not 
classified, ^^^^wiskcd to view the statement of work OIG had obtained before confirming 
the “Draft/Confidential” document was the same document and therefore not classified. 
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Bliss, fo llo wing Nationa l Securit y Infonnation (NSI) guidelines, couriered the document to 
fn.g| review. upon review, confirmed that the document was the OTOP 

statement orwork and thWmedocument was not a classified document marked at the 
confidential level. 

RECOMMENDATION: Based on the results of the investigative activity and the confirmation 
that the document posted on the internet was not a classified document, the Complaint was 
determined to be unfounded. This Complaiint will be closed at this time. 
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UNITED STATES ENVIRONMENTAL PROTECTION AGENCY 
OFFICE OF INSPECTOR GENERAL 


DATE: March 16, 2016 
CASE#: 01-AT-2015-ADM-0062 


PREPARED BY: 

CROSS REFERENCE #: 



CASE CLOSING REPORT 



VIOLATIONS: 

18 U.S.C. §1905 - Disclosure of confidential information generally 
40 CFR §2.211 - Safeguarding of Business Information 
EPA Policy 2155.3 - Records Management Policy 

EPA Region 4, Regional Directive: R4 2160.4 - Procedures for Handling Confidential Business 
Information (CBI) 


ALLEGATIONS: 


released, without authorization, CBI belonging to Great Lakes Dredge and Dock Company, 
LLC (GLDD) 


FINDINGS: 

On February 20, 2015, pursuant to an official request for information, the U.S. Army Coips of 
Engineers (COE) provided EPA with confidential business information (CBI) information, via 
email, related to its (COE) Port of Miami dredging project. The information was provided in the 
form of a letter (#S-0050) from Great Lakes Dredge and Dock Company, LLC (GLDD) to COE 
dated 02/16/2015 and partially titled . Miami Harbor Deeping (Phase 3).. .Disposal of 
Excavated Material and Data Reporting Concern.” The footer on each page of the GLDD letter 
clearly identified the information contained in the document as CBI. In addition, the COE 
included a cover letter for the document which directed EPA not to release the GLDD 
information outside EPA without the consent of GLDD. The COE correspondence was directed 
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forwarded the information to parties within EPA Region 4, to include | 

On February 26, 2015, pursuant to a verbal request, released, via email, several 

documents to the Florida Department of Environmental Protection (DEP) related to the Port of 
Miami dredging project. Included in these documents were the previously described CBI. 


Evidence obtained dining the EPA-OIG investigation supported a conclusion thaJJ^m failed 
to comply with regulations and procedures related to the handling of CBI by releasing, without 
authorization, CBI obtained under the regulatory authority of EPA, to DEP. This unauthorized 
release resulted in the CBI being placed on DEP’s publicly accessible website as well as the 
direct release of the CBI by DEP to an environmental organization under the State of Florida 
“Sunshine Law.” COE/GLDD is involved in civil litigation with this organization over activities 
related to the Miami Harbor diedging project. 

During EPA-OIG interview. admitted to intentionally releasing the GLDD information to 

the Florida Department of Environmental Protection (DEP), but denied any knowledge that the 
information was classified as CBI. Whe n confr onted with th e fa ct that eveiy page of the GLDD 
document was clearly identified as CBI, ^^^Breported that “didn’t appreciate the 
importance” of the GLDD notifications antrassuruedM release 
another regulatory agency. 


SsumedB release was justified because DEP was 


DISPOSITION: 


The result of this investigation was presented to AUSA Alana Bla ck, North ern District of 
Georgia, for prosecutorial consideration. Crimi nal prosecution of related to the 

disclosure of CBI (18 USC 1905) was declined. 


This investigation was then referred to Region 4 officials for re view an d administrative action 
deemed appropriate. As a result of the EPA-OIG investigation, was issuecDi letter of 

warning for policy violation related to the mishandling of CBI. Additionally. was directed 

to review the EPA policy related to the handling of CBI as well as complete a formalized 
training course related to this subject. 

This concluded all pending actions and this investigation will be closed. 
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UNITED STATES ENVIRONMENTAL PROTECTION AGENCY 

WASHINGTON, D C 20460 



OFFICE OF 

INSPECTOR GENERAL 


December 18, 2017 


MEMORANDUM 

SUBJECT: Office of Inspector General Hotline Complaint 2018-0097 

FROM: 

Special Agent, Hotline Manager 
Headquarters, Office of Inspector General 

TO: Patrick Sullivan 

Assistant Inspector General 
Office of Investigations 



The Environmental Protection Agency (EPA), Office of Inspector General (OIG), Hotline 
received a forwarded electronic message detailing an allegation that there was an unauthorized 
access to the EPA Administrator's travel records. This allegation is being forwarded to the 
Office of Professional Responsibility. 

Please inform the Hotline upon the completion of this assignment so that it can be closed. If you 
have any further questions, please call me (202) 566-2576. 

Attachment: 
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From: 

Sent: 

To: 

Cc: 

Subject: 


Sullivan, Patrick F. 




Thank you for informing me about the allegation that an unknown person or person(s) has accessed Administrator Scott 
Pruitt's official EPA Concur travel records without authorization, and then provided these records to the Associated 
Press and the Washington Post. Furthermore, you informed me that you believe the unauthorized disclosure of the 
Administrator's travel records presents a risk to his safety and security, and a risk to the safety and security of the 
special agents assigned to the Protective Service Detail. You also said you believe the unauthorized access of these 
records, and the subsequent unauthorized disclosure, may be a violation of Federal criminal law, as well as a violation of 
EPA policy. 

In addition, you said that you may have more information to provide, and I told you that I would get back to you 
concerning the next steps that the OIG will take. 

The situation that you have reported to me is a potential violation of EPA policy and may also be a violation of 18 USC 
1030, Unauthorized Access to a Government Computer System, as well as other statutes. It is within the jurisdiction of 
the OIG to investigate this allegation. 

I am forwarding your information to the OIG Hotline to open a formal complaint. 

Special agents assigned to the OIG Office of Professional Responsibility (OPR) will probably need to conduct a formal 
interview with you in the near future to gather more detailed information. 

Thank you, 


Patikh 5. SuUivan 


Assistant Inspector General for Investigations 
EPA Office of Inspector General 
Desk: (202)566-0308 


Cell: 

FAX: (202) 566-0814 
Email: sullivan.patrick@epa.eov 


To report fraud, waste or abuse impacting EPA, please contact the EPA OIG Hotline via telephone numbers 202-566- 
2476 or 888-546-8740, fax 202-566-2599, or email at oig_hotline@epa.gov 

To report threats directed against EPA employees, contractors, facilities and assets, please email 
report.EPA.threats@epa.gov 


1 
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UNITED STATES ENVIRONMENTAL PROTECTION AGENCY 

WASHINGTON, D C. 20460 
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OFFICE OF CHEMICAL SAFETY 
AND POLLUTION PREVENTION 


AUG 2 8 2014 

MEMORANDUM 


SUBJECT: 

FROM: 


TO: 


Release of Confidential Busines 


Arthur A. Elkins, Jr., Inspector General 
Office of Inspector General 



The Federal Insecticide, Fungicide, and Rodenticide Act (FIFRA) Information security 
Manual states that when a breach of security occurs it must be reported to the FIFRA Security 
Office and the Division Director. If the unauthorized person to whom the release was made is 
not an EPA employee, the Office Director must notify the EPA Inspector General, who may 
decide to conduct an investigation. 


Pursuant to the procedures set forth in the FIFRA Security Manual, I am informing you 
of the unintentional disclosure of Green Products Company’s confidential business information 
- specifically, 

was inadvertently posted along with the approved labeling for EPA Registration 
Number 66591-1 to EPA’s public website. 


On 8/8/14, the Antimicrobials Division received a letter from a consultant for Green 
Products Company notifying the Agency that an EPA letter dated 9/16/10 disclosed Confidential 
Business Information (CBI) when the letter was posted to EPA’s Pesticide Program Labeling 
System (PPLS), a public website from which users can view EPA-approved pesticide labeling. 
Upon receipt of the letter, the 

immediately requested that the document be removed from the 
database. The document was removed less than one hour after the request. According to the 
procedures specified in the FIFRA Security Manual, on 8/8/14, the PM also notified the | 

|, who, that same day, then notifiec 

the that a 

breach had occurred. 
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Between 8/11/14 and 8/12/14, investigated the potential breach by 

examining the 9/16/10 EPA correspondence and interviewing staff. Based on the investigation, 
it was determined that the CBI breach occurred due to a 2010 change in the Information 
Technology and Information Management Division’s (ITRMD) internal practices associated 
with PPLS that was not adequately communicated to Antimicrobials Division staff. 

For background, most information related to pesticide registrations can be modified only 
after EPA review. 40 CFR 152.46 was revised on 8/26/96 to allow EPA to issue procedures 
describing modifications to registration that are permitted by “notification.” A notification is a 
submission from the registrants to make certain modifications to their previously approved 
product, including labeling, that have no potential to cause adverse effects to the environment. 

As part of a notification, the registrant must include a certification statement indicating that no 
other changes have been made to the label other than those specified. Unlike label amendments 
or new product applications that undergo full EPA review, notifications undergo limited EPA 
review; EPA responds to both notifications and non-notifications to communicate the outcome of 
the Agency’s review. 

When PPLS was launched, only labels that required a full EPA review (i.e., non¬ 
notifications) were loaded into the system for public viewing. In 2010, the scope of documents to 
be loaded into PPLS was expanded to include notifications. At the time the 9/16/10 EPA 
response to the notification was written, the practice of uploading notifications to PPLS had been 
adopted by ITRMD but had not been adequately communicated to the Antimicrobials Division 
staff. As a result, neither the EPA staff who prepared the letter, norH^yfi^ 

signed the letter was aware that the correspondence containing CBI would be posted to PPLS. 

In 2011, the Antimicrobials Division conducted CBI training to ensure, among other 
things, that all regulatory staff understood how to modify correspondences to prevent future 
inadvertent disclosure of CBI. The breach that resulted from the 9/16/10 letter occurred prior to 
this detailed training and during a point when not all employees were aware of the change in 
ITRMD practices to post notifications to PPLS. Since then and as recently as 2/6/13, the division 
has held additional mandatory CBI trainings in coordination with the OPP FIFRA Security 
Officer. The trainings focused on how to identify CBI, how to prevent violations of the FIFRA 
Security Manual, and how to avoid CBI breaches. The trainings are held in addition to the annual 
mandatory training associated with the annual renewal process for CBI access. Additionally, 
individual mentoring is currently taking place with staff on an ongoing basis to ensure proper 
procedures are followed to appropriately handle CBI. 

Please feel free to contact me if any additional information is required or if I can offer 
any assistance in this matter. 
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MEMORANDUM 


To: Patrick Sullivan, Assistant Inspector General for Investigations 


From: I 


Date: September 16, 2014 


Re: OIG Discretion in Investigating Report of Unauthorized Confidential Business 
Information (CBI) under the FIFRA 


EPA's Office of Pesticide Programs self-reported an unintentional disclosure of CBI to the OIG 
on August 28, 2014. 
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